O-UNC-066 Exploits Microsoft Entra Passkey Enrollment in Vishing Scheme
Executive Summary
In April 2026, a threat actor identified as O-UNC-066 initiated a sophisticated vishing campaign targeting Microsoft 365 users across multiple sectors, including food and beverage, technology, healthcare, automotive, construction, and aviation. The attackers impersonated internal security personnel, contacting employees via phone and instructing them to enroll a new Microsoft Entra passkey for enhanced security. Victims were directed to phishing websites that closely mimicked Microsoft's legitimate passkey enrollment process. Unbeknownst to the users, this process allowed the attackers to register their own passkeys, thereby gaining unauthorized access to the victims' Microsoft 365 accounts. Subsequent to gaining access, the attackers engaged in data exfiltration activities, targeting sensitive information stored in SharePoint and OneDrive. (bleepingcomputer.com)
This incident underscores a concerning trend in cyber threats, where attackers exploit legitimate security features to deceive users. The abuse of Microsoft's passkey enrollment process highlights the need for organizations to implement robust user education programs and to remain vigilant against evolving social engineering tactics. (bleepingcomputer.com)
Why This Matters Now
The exploitation of legitimate security features, such as Microsoft's passkey enrollment, by threat actors like O-UNC-066, highlights the urgent need for organizations to enhance user awareness and implement stringent verification processes to counter sophisticated social engineering attacks. (bleepingcomputer.com)
Attack Path Analysis
The attacker initiated the attack by impersonating IT support and convincing Microsoft 365 users to enroll a new Entra passkey via a phishing site. Upon obtaining initial access, the attacker registered their own passkey, granting persistent access to the victim's account. With this access, the attacker escalated privileges by modifying authentication methods and accessing sensitive data. The attacker then moved laterally within the organization's cloud environment to identify and access additional resources. To maintain control, the attacker established command and control channels using the compromised accounts. Finally, the attacker exfiltrated sensitive data from platforms like SharePoint and OneDrive, leading to data extortion.
Kill Chain Progression
Initial Compromise
Description
The attacker impersonated IT support and convinced Microsoft 365 users to enroll a new Entra passkey via a phishing site.
MITRE ATT&CK® Techniques
Spearphishing Attachment
Valid Accounts
Password Guessing
PowerShell
LSASS Memory
SMB/Windows Admin Shares
Data Encrypted for Impact
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Multi-Factor Authentication
Control ID: 6.4.3
NYDFS 23 NYCRR 500 – Multi-Factor Authentication
Control ID: 500.12
DORA – ICT Risk Management Framework
Control ID: Article 6
CISA ZTMM 2.0 – Identity Verification
Control ID: Identity and Access Management
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
High-value targets for Microsoft 365 phishing attacks using fake Entra passkey enrollment, enabling data extortion with severe regulatory compliance implications.
Health Care / Life Sciences
Critical HIPAA compliance risks from social engineering attacks targeting Microsoft 365 systems containing sensitive patient data vulnerable to exfiltration.
Information Technology/IT
Primary attack vector targets IT infrastructure managing Microsoft 365 environments, with panel-controlled phishing kits compromising multi-tenant security architectures.
Government Administration
Voice-based social engineering threatens sensitive government Microsoft 365 deployments, risking classified data exposure through sophisticated passkey enrollment manipulation.
Sources
- Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Accesshttps://thehackernews.com/2026/07/hackers-use-fake-microsoft-entra.htmlVerified
- Entra passkey enrollment vishing targets Microsoft 365 usershttps://www.bleepingcomputer.com/news/security/entra-passkey-enrollment-vishing-targets-microsoft-365-users/Verified
- Fake Microsoft 365 Passkey Setup: O-UNC-066 Vishinghttps://blog.gridinsoft.com/fake-microsoft-365-passkey-setup/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could likely limit the attacker's ability to move laterally and exfiltrate data by enforcing strict segmentation and identity-aware policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: While Aviatrix CNSF primarily focuses on network-level controls, it could potentially limit the attacker's ability to exploit compromised credentials by enforcing strict segmentation and identity-aware policies.
Control: Zero Trust Segmentation
Mitigation: Aviatrix Zero Trust Segmentation could likely limit the attacker's ability to escalate privileges by enforcing strict access controls and segmenting network resources.
Control: East-West Traffic Security
Mitigation: Aviatrix East-West Traffic Security could likely limit the attacker's lateral movement by enforcing strict segmentation and monitoring internal traffic.
Control: Multicloud Visibility & Control
Mitigation: Aviatrix Multicloud Visibility & Control could likely limit the attacker's ability to establish command and control channels by providing comprehensive monitoring and control over network traffic.
Control: Egress Security & Policy Enforcement
Mitigation: Aviatrix Egress Security & Policy Enforcement could likely limit the attacker's ability to exfiltrate data by enforcing strict egress policies and monitoring outbound traffic.
While Aviatrix CNSF cannot prevent the initial compromise, its controls could likely limit the attacker's ability to exfiltrate data, thereby reducing the potential impact of extortion.
Impact at a Glance
Affected Business Functions
- Email Communication
- Document Management
- Collaboration Tools
- Cloud Storage
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of sensitive corporate documents, emails, and internal communications.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict access based on identity and context.
- • Enforce Egress Security & Policy Enforcement to monitor and control outbound traffic.
- • Utilize Threat Detection & Anomaly Response to identify and respond to suspicious activities.
- • Deploy Inline IPS (Suricata) to detect and prevent known exploit patterns.
- • Educate users on recognizing and reporting phishing attempts to prevent initial compromise.
